Privacy

Who handles your data

Basalt Works, the maker of Bossiko. You can write to us at contact@bossiko.com.

If you just visit the website

We don't ask you for any data and we don't use analytics or advertising tools. The server keeps technical logs (IP address, page and time) for a short while so the website works and stays secure.

If you create an account

You sign in with your Google account: we receive your email, your name and your profile picture, and only use them for your account and your companies. We process them because we need them to provide the service.

What you do in your office

Your company profile, the jobs, the documents and the emails you receive if you forward them to the office or connect Gmail (we only read them: you send the replies) and what the team reads on the websites it opens in your browser if you connect the extension (never your passwords, your cookies or your other tabs) are stored in your office, kept apart from all others. For the team to work, what each job needs is sent to the providers below. We don't use your data for anything else and we don't sell it to anyone.

During the free trial of Essential

To improve the product, during the free trial of Essential we may review, internally, your business's sector and your first jobs (what you ask for and what the team delivers), to understand who Bossiko is useful for and what goes wrong. Only we do this, we don't pass it on to anyone and we don't use it to train AI models. It's based on our legitimate interest in improving the service, and you can object by writing to contact@bossiko.com.

Who else receives data

These providers help us run the service and only receive what they need for their part:

• Hetzner Online GmbH (Germany)
  Hosts the office on servers in Nuremberg: your account, your companies, your files and their encrypted backups.
• OpenAI (United States)
  The AI models the team works with: it receives what each job needs (your messages, the company profile, the documents the employee reads and the pages it opens in your browser if you use the extension), when you dictate, the audio, and what your customers write to the public assistant.
• Vercel Inc. (United States)
  Hosts this website and, with its AI Gateway, passes to each provider's model the images that are generated or edited, voice dictation and, as a fallback, the other jobs.
• Google (United States)
  Sign-in (your email, your name and your picture) and, if you connect Gmail, reading the emails you receive.
• Amazon Web Services (Amazon SES) (United States)
  Sends your office's emails (the notices, the weekly report and the confirmation of the appointments your customers book with the assistant: the address and what they say) and, if you forward your email to the office's address, receives it in Ireland and keeps it until your office picks it up, a few seconds (7 days at most).
• Telegram (outside the EU)
  Only if you connect it: the notices and the messages you exchange with your team there.
• Polar Software, Inc. (United States)
  Payments and invoices: your billing and payment details. As the seller, it's also responsible for what it processes to charge and invoice you.
• Cloudflare, Inc. (United States)
  Only in the public assistant of the companies that turn it on: it checks with Turnstile that whoever starts writing to it isn't a robot (it gets technical data from their browser and their IP address).
• Brave Software, Inc. (Brave Search) (United States)
  The employees' search engine: receives the search terms they write, sent from our server.
• DuckDuckGo (United States)
  Only when Brave Search is not configured: receives the search terms the employees write, sent from our server.

Those outside the European Union process the data with the safeguards the GDPR requires: the EU-US Data Privacy Framework, if the company is certified, or the European Commission's standard contractual clauses. We also keep a second backup, also encrypted, on a machine of our own in Spain.

If your business gives us other people's data

For the personal data about other people that you put into your office (your customers, suppliers or staff), your business is the controller and we are its processor: we process it only to provide the service, with the providers above. It's governed by the data processing agreement, which you accept with the terms. Data processing agreement

If you talk to a company's assistant

Some companies that use Bossiko have an artificial intelligence assistant on their website or social media. If you talk to it, that company is responsible for your data (its privacy policy is linked before the first message) and we process it on its behalf: what you write, the contact details you choose to leave and the appointments you book are kept in that company's office for 12 months after your last message (appointments, 12 months after their date) and, to answer you, they're sent to the AI model. So nobody abuses the chat, we use a cookie of our own and your IP address, which we don't keep with the conversation, and, if it's on, Cloudflare Turnstile checks you're not a robot. To exercise your rights, write to the company; if you don't know how, write to us at contact@bossiko.com and we'll pass it on.

How long

While you have your account. If you delete a company, it can be recovered for 30 days and is then erased for good. Backups, encrypted, are deleted by themselves within about 6 months, and the activity log (who signs in, from which IP address and what they change, for the service's security) after a year. You can delete your whole account whenever you like from your account, or ask us to; of it we only keep an encrypted fingerprint of your Google account, without your email, so the free trial of Essential isn't repeated.

Your rights

You can download the data of each of your companies from your account, and ask to see, correct or delete your data or object to its use by writing to contact@bossiko.com. If you think we're not handling it well, you can complain to the Spanish Data Protection Agency (aepd.es).

Cookies

This website uses no tracking or advertising cookies: only one to remember the language you choose, if you have an account, another to keep you signed in and, in a company's assistant chat, another to limit each visitor's messages.